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Date of Interview 

07 April 2009 

Attendants 

Examiner Brett Squires 

Shun Yao, Reg. Number 59,242 

Identification of Claims and Reference Discussed 

Claim(s) for discussion: Claim 1 . 
Reference(s) for discussion: Pruthi. 

Proposed Amendment: 

In view of the telephone conference scheduled on 07 April 2009, 
Applicant kindly asks Examiner to consider the following proposed amendment. 
Applicant has re-written claim 1 with more clarification based on the allowable 
subject matter. 

1 1 . (Currently amended) A computer implemented method of detecting 

2 scanning attacks, comprises: 
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3 adding host-pair connection r ecords to a connection table first data 

4 structure stored on a computer readable medium when a host accesses another 

5 hos t during a first update period ; 

6 at the end of a first update period, accessing the connection table to 

7 determine new host pairs; determining the number of new host pairs added to the 

8 connection table first data structure over the first update period; and 

9 aggregating records from the first data structure into a second data 

10 structure which corresponds to a second update period that is greater than the first 

11 update period; 

12 determining the number of new host pairs added to the second data 

13 structure over the second update period; and 

14 indicating a host as a scanner when at least one of the following 

15 conditions is true: 

1 6 (1) if-athe host has madc appcars in more than a first threshold number 

17 "CI" host pairs within the first update period , and an-a_historical number of host 

1 8 pairs is smaller than the first threshold number by a first factor value "C2;" and 

19 rthen 

20 (2) the host appears in more than a second threshold number "C4" host 

21 pairs within the second update period, and a historical number of host pairs is 

22 smaller than the second threshold number by a first factor value "C5." 



Outcome of Interview 

Examiner indicated that "host-pair connection record" would be more 
clear and that the terms "CI," "C2," "C4," and "C5" could be confusing. 
Examiner indicated that a new search would be conducted after a formal response 
is filed. 



2 

SY Amendment E RIV-0490 (Interview Summary).doc 



Respectfully submitted, 



By /ShunYao/ 

Shun Yao 

Registration No. 59,242 
Date: 20 April 2009 

Shun Yao 

Park, Vaughan & Fleming LLP 
2820 Fifth Street 
Davis, CA 95618-7759 
Tel: (530) 759-1667 
Fax: (530) 759-1665 
Email: shun@parklegal.com 
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